You wake up to a notification from your bank — multiple charges from Meta, Facebook's parent company, totaling amounts you never authorized. Or your Facebook Business Manager sends an alert that your ad account has been spending overnight on campaigns you never created.
Your ad account has been hacked. Someone has used your payment method to run their own advertising campaigns — promoting their products, their pages, or their affiliate links — entirely at your expense.
This is one of the fastest-growing forms of digital fraud targeting Nigerian business owners who run paid social media advertising, and Sir Brown AD is explaining exactly how it happens and how to stop it.
Who Gets Targeted
Any Nigerian business owner with a Facebook or Instagram ad account linked to a payment method is a potential target. This includes small businesses running occasional boosted posts, established brands managing full campaign budgets, marketing agencies managing multiple client accounts, and content creators using paid promotion to grow their audience.
The more active your ad account and the higher your spending limit, the more attractive it is to hackers.
How Ad Account Hacking Works
The Phishing Approach
The most common entry point. You receive an email or a Facebook notification warning you that your ad account has been flagged for policy violations, that your payment has failed, or that your account will be suspended unless you verify your details immediately.
The message looks exactly like an official Meta communication — same logo, same formatting, same tone. The link it contains takes you to a page that looks identical to Facebook's login page. You enter your credentials. They are captured immediately by the hacker.
Within minutes of entering your details on a phishing page, a hacker has accessed your ad account, added their own payment method as a backup, created campaigns for their own purposes, and in many cases removed you as an admin from your own account.
The Compromised Third-Party App Approach
You connected a third-party tool to your Facebook Business Manager — a scheduling app, an analytics platform, or a social media management tool. That tool's database was breached, and your Facebook access token was exposed. Hackers used that token to access your ad account without needing your password.
The Weak Password Approach
Your Facebook account uses a simple, reused password that appeared in a previous data breach. Hackers use automated tools that test leaked passwords against Facebook accounts — a process called credential stuffing. Your account matched, and they gained access.
The Trusted Person Approach
Someone you added to your Facebook Business Manager — a former staff member, a freelance social media manager, or an agency you stopped working with — still has admin access to your account. They either use it maliciously or their own account gets hacked, providing indirect access to yours.
What Happens After Your Account Is Hacked
Hackers who access ad accounts move quickly because they know the window before discovery is limited.
They create new campaigns immediately, often running them at maximum spend to extract as much value as possible before you notice. These campaigns typically promote overseas e-commerce stores, affiliate marketing schemes, cryptocurrency fraud pages, or adult content sites.
They may add their own payment method to the account and attempt to increase your credit limit. They may remove you as an admin so you cannot immediately shut down the campaigns. And they will often change your account email and phone number to lock you out completely.
How to Secure Your Facebook Ad Account Completely
Enable two-factor authentication immediately.
Go to your Facebook Settings → Security and Login → Two-Factor Authentication and enable it using an authenticator app rather than SMS. An authenticator app generates time-sensitive codes that cannot be intercepted through SIM swapping — a vulnerability that SMS-based two-factor authentication has.
This single step prevents the majority of ad account hacking attempts.
Use a unique, strong password for Facebook.
Your Facebook password should not be used on any other platform. Use a password manager to generate and store a complex, unique password. If your Facebook password has been used elsewhere — change it today.
Audit your Business Manager admin access.
Go to your Facebook Business Manager settings and review every person who has admin or employee access to your account. Remove anyone who no longer needs access — former staff, agencies you no longer work with, anyone whose role has changed. Access you cannot account for is access you should remove.
Review connected apps and remove unnecessary ones.
Go to your Facebook Settings → Apps and Websites and review every third-party application connected to your account. Remove any you no longer use or do not recognize. Each connected app is a potential entry point.
Set up email alerts for ad account activity.
Configure your Meta Business Suite to send email notifications for significant account activity — new campaigns created, spending thresholds reached, payment method changes, and new admin additions. Early alerts give you the opportunity to respond before damage accumulates.
Use a dedicated email address for your Facebook Business account.
Do not use your personal Gmail for your Facebook Business Manager. Create a separate email address used exclusively for your business Facebook account. This isolates the risk and makes phishing attempts easier to identify — any email to your personal address about your Facebook business account is immediately suspicious.
Never click login links from emails or messages.
Always navigate to Facebook directly by typing facebook.com in your browser. Never click a link in an email claiming to be from Meta, Facebook, or Instagram — regardless of how official it looks. If there is a real issue with your account, it will be visible when you log in directly.
What to Do If Your Ad Account Has Been Hacked
Report to Meta immediately through their official hacked account recovery process at facebook.com/hacked. This is time-sensitive — the faster you report, the sooner Meta can investigate and potentially stop the fraudulent spending.
Contact your bank or card provider immediately to dispute the unauthorized charges and request a block on further Meta charges while the investigation is ongoing.
Remove all unknown admins from your Business Manager as soon as you regain access. Change your password and review all connected apps.
Document everything — screenshots of the fraudulent campaigns, the spending amounts, and any communications — for your bank dispute and any formal complaints.
Conclusion
Your social media ad account represents real money — your payment method, your spending limit, and the trust Meta extends to your business based on your history. It deserves the same security attention you give to your bank account.
Sir Brown AD has watched Nigerian businesses absorb losses of hundreds of thousands of naira from ad account hacking — losses that were entirely preventable with basic security practices.
Two-factor authentication. Unique password. Regular access audits. These three things alone eliminate most of the risk. Implement them today — before you need to.
Get new Security & Fraud alerts
One email when a new security & fraud article like this one goes live. No spam, unsubscribe anytime.
